Better Together

Today, you’d be hard-pressed to find someone who doesn’t use multiple devices for work. Users have phones, tablets and computers to stay more connected and productive than ever. Many organizations choose to manage these devices in order to ensure they are set up correctly, provide access to corporate resources, and ultimately ensure security and compliance. The question is how do you manage the various platforms you have in your environment? Some organizations have separate teams purchasing and managing mobile devices (e.g., a Telecom team) and another (IT team) purchasing and managing computers — resulting in multiple management tools within the same organization. However, Microsoft, Google and Apple are all pushing for a unique experience across each of their desktop and mobile platforms. This puts the multiple management tools model at odds with the interconnected platform vision, which has spawned the notion of “unified endpoint management” (UEM), where all devices are managed by a single management tool. This might sound great, but begs the question, “what is universal across Microsoft, Apple and Google?”

The reality is desktop operating systems — Windows, macOS and Chrome OS — have little in common. All have a unique workflow to provision, encrypt, deploy, secure, update and support devices. The same “uniqueness” also applies to the mobile platforms: iOS, Windows Mobile and Android. This is where UEM fails; no one management tool is designed to support everything. So, you as an organization have to choose: This e-book breaks down these choices facing you and your IT staff, and how it impacts you and your users.

Approaching Management Through the Lens of an Ecosystem. Let’s start by examining the various types of device management models and what they mean. Whether you manage your devices separately by device type or attempt to put them all in one unified tool, you are forced to support the lowest common denominator. The lack of commonalities across various device types coupled with unique and frequent upgrade cycles, means there is no one-size-fits-all approach to device management. The reality is that unified management tools aren’t designed to support every device type and platform, and organizations are often relegated to a “master of none” toolset.

Instead of focusing on the individual devices you manage, what happens when you focus on the ecosystems (i.e., platform or brand) you manage? When you organize vertically by ecosystem, you start to see commonalities. Windows and Windows Mobile have commonalities, and Microsoft provides first-party management tools with Intune and SCCM. Chrome OS and Android are moving closer together, and both can be managed by Google’s native management tools in G Suite. And, because Apple is known for creating an integrated IT and user experience across all of its device types, we will use it to best illustrate the value of managing devices by ecosystem. Apple’s operating systems are converging, and by design, are part of their own ecosystem. iOS and macOS share a common management framework, and this has been extended to tvOS. To get the most out of the Apple ecosystem, these devices can be managed together with a purpose-built management tool, such as Jamf. 

By choosing to manage devices by ecosystem rather than device type or unified tool, you optimize all management tasks without compromising their functional benefits. Let’s explore the different ecosystem workflows for Apple, Microsoft and Google. E

As you can see, these ecosystem workflow differences require different ways to provision devices, apply settings and deploy software. And, this lack of universal workflows alone should be argument enough that unified endpoint management is not ideal for managing multiple ecosystems. However, if you approach management by ecosystem, you can achieve the best of both worlds — efficient management and security for your IT team balanced with a delightful user experience. Let’s look at how Apple’s ecosystem shares management commonalities across its operating systems — macOS, iOS and tvOS.

Starting With the Apple Ecosystem Apple continues to build an interconnected ecosystem. In fact, they are the leading example of a blended desktop and mobile experience. Apple embraces a consistent user experience across their entire ecosystem. iMessage, FaceTime and other Continuity features work across all Apple devices. For example, users can unlock their Mac from their Apple Watch, create a presentation on their Mac and continue editing the presentation on their iPad, then share the presentation wirelessly to their Apple TV. And, with enhancements to virtual personal assistants, like Siri, the Apple ecosystem is expected to become even more interconnected through voice commands. The “seamlessness” of the Apple ecosystem creates an incredible user experience, and it also caters to IT in an enterprise setting. Apple has specific enterprise programs to help streamline deployment and create an out-of-box experience for users. Apple’s Device Enrollment Program (DEP) and Volume Purchase Program (VPP), combined with mobile device management (MDM), result in consistent management of Mac, iPad, iPhone and Apple TV devices. These management features are exclusive to the Apple ecosystem and need to be properly supported in a management tool.

. Keeping Pace with Ongoing Updates

Ensuring a seamless experience for your users is an ongoing process — one that includes continually supporting new features and capabilities on your devices. Apple, like other technology providers, have regular upgrade cycles for their operating systems, so it is critical from both a security and functionality standpoint to ensure your users can upgrade to the latest releases. With every new release, macOS, iOS and tvOS become more integrated with each other, and Apple users are quick to upgrade to the latest features. Why? The upgrade process is simple and they want to take advantage of the latest capabilities. In fact, statistics show that 86 precent of iPhone and iPad users are on iOS 10, compared to only 7 percent who are on the latest Android operating system. However, because Apple and Microsoft upgrades are delivered differently, they need to be managed differently

While new operating systems and features enhance the user experience, users only benefit from the latest and greatest if and when all of their Apple devices are fully supported. If you subscribe to the UEM model, you are reliant on your vendor’s ability to support multiple and competing maintenance cycles. Per the graphic, UEM providers have a lofty set of expectations to meet, and often choose (or are forced by resource or time constraints) to cater to the lowest common denominator. As a result, support for the latest platform updates are often delayed by months, quarters, or worse, never supported. In addition to diminishing the user experience, when UEM software can’t immediately adopt the latest platform updates, organizations using those tools are exposed to security vulnerabilities and broken workflows. The best way to keep users productive and your organization protected is through a purpose-built solution that immediately supports updates to each platform’s specific ecosystem. This isn’t a luxury, but rather a baseline requirement for successfully and securely managing your devices

Apple Hardware Purchasing Under One Roof

Apple’s centralized hardware enrollment portal, known as the Device Enrollment Program (DEP), enables zero-touch deployment, meaning IT can pre-configure devices and allow users to simply unwrap their new device, turn it on, and go through the Setup Assistant process. Their device is automatically enrolled into management and ready for use. This Apple-exclusive deployment and enrollment process is available for macOS, iOS and tvOS. Managing this process with a tool dedicated to the entire Apple ecosystem is simple and avoids the need to implement the multiple, redundant workflows if macOS, iOS and tvOS devices are managed by different tools. Things get messy fast if an organization uses different tools to manage different Apple device types. While DEP can support multiple MDM servers, IT administrators are then required to manually separate orders in the DEP portal and assign Mac and iOS devices to the corresponding MDM server. The DEP portal does not show a list of purchased devices, so the process of assigning devices requires IT to enter the (lengthy) serial number or order number in the DEP portal, which is tedious and prone to errors. If assignment of devices to an MDM isn’t completed in the DEP portal before the device is delivered to the user, then the device isn’t properly setup. Organizations can eliminate the need to place separate orders with separate account numbers for Mac, iPad, iPhone and Apple TV devices by keeping your DEP account linked to a single ecosystem-specific MDM solution. This equates to an automated management experience for IT.

Apple Software Licensing and App Purchasing Under One Roof

What sets Apple apart from others on the market is its ecosystem of apps. Apps are core to enabling user productivity, and Apple has a rich App Store. However, downloading apps from the App Store traditionally required an Apple ID. This all changed with the Volume Purchase Program (VPP). VPP is a streamlined method for purchasing and managing apps in bulk, and it’s the only method to distribute App Store apps. Leveraging a single ecosystem management solution streamlines deployment and management of these apps. Furthermore, keeping purchasing, assignment and distribution all linked to a single ecosystem management solution reduces complexity and avoids potential loss of data. Apple Software Licensing and App Purchasing Under One Roof Why should you use VPP with a single Apple management solution? Purchase IT purchases all Apple apps in one central location regardless of the device / operating system. Assign App assignments are easier with a single VPP account because all available purchases are linked to one central location versus multiple VPP accounts. Apple IDs are not required for device-based assignments. Distribute VPP apps are all listed in your single MDM and ready to be deployed to users. Renew VPP tokens need to be renewed annually. If an IT administrator uploads the wrong VPP token to the wrong MDM solution, there is a risk of accidentally revoking all previously distributed apps. Keeping one VPP token with one MDM server reduces this risk.

. What about Apple IDs?

Apps can leverage iCloud to sync mobile, desktop and even Apple TV operating systems. This allows the user to start utilizing an app on their phone and then pick up right where they left off on their computer. This app hand-off and sync is possible because of a user’s Apple ID. If your information security team approves of iCloud, you can allow your users to use their own Apple IDs and still deploy apps via devicebased assignments.

Apple User Resources Under One Roof

Users demand the same seamless technology, support and service experience regardless of what device they use, and this expectation doesn’t stop once the device is in their hands. There are many ways to extend the consumer Apple ecosystem experience. One way do so is through a managment app. A management app enables IT to curate assets and provide users with an easy way to obtain resources and services, such as apps, printers, troubleshooting shortcuts and documentation. Anything loaded in the app is ITapproved, so instead of sending you a ticket, employees go directly to the app and immediately download the needed items — saving time for both you and your users. Segmenting your Apple devices in separate management solutions forces end users to interact with different apps for Mac and iOS, ultimately creating confusion for where to go for what device. Streamlining ecosystem management with one solution gives you a common app for all Apple platforms. Users gain a consistent experience with a portal that has one brand, name, look and feel across both macOS and iOS.

Where Ecosystems Intersect The need for a holistic view into your environment is undeniable. Commonly referred to as a single pane of glass, you want the status of all endpoints, the ability to generate reports for senior management, and get a 360-degree view into your inventory. While UEM providers pitch this as the core reason for one universal tool, the lack of up-to-date support for the latest platform features overshadows the value of what you get with one window into your world. Instead, look to proven, purpose-built business intelligence / reporting tools for your single pane of glass. Rather than reporting from your device management tool alone, aggregate the data into a BI or IT service management tool (e.g., Domo, Splunk, Tableau and ServiceNow), which is designed to show dashboard data. This lets each ecosystem management tool do what its designed to do best — manage devices. All device data can then be sent to a reporting / BI tool. 

The Power of “And”

When you mange by ecosystem, it’s important to consider a management solution that fits seamlessly into your existing IT infrastructure. Services such as identity access management, directory services and network access, which may already be in your environment, are becoming platform agnostic and should extend across your managed ecosystems. Identity management, network access control and directory services can easily work with Apple, Microsoft and Google devices, but are not directly built into most device management solutions. Instead, rely on purpose-built service providers to handle identity management, directory services and network access to do what they do best instead of hoping a unified tool can do it all. An integration-friendly ecosystem device management tool that can connect to existing IT services is better for organizations in the long run because it leverages what’s best about the platforms while fitting into a broader IT strategy.

. Jamf Integrations

Jamf’s platform is able to integrate with third-party tools, such as ServiceNow, RobotCloud, Tableau, Splunk and even SCCM to share your Apple inventory data. This gives you a better reporting for all your device and better management for your Apple devices. Jamf builds solutions that extend and connect. From cross-industry integrations to specific solutions, Jamf integrates with more than 200 providers to ensure we work the way you need us to work.

Conclusion The power of Apple devices cannot be denied. And, the more computer and mobile teams unite to manage Mac, iPad, iPhone and Apple TV devices under one management solution, the better your management experience will be and the more you will empower your users. The right solution for your Apple platform provides your team with zero-day support and streamlined workflows to implement DEP, VPP and leverage MDM profiles to customize the device experience for all of your users. Jamf is the tool trusted by those who trust Apple. As the standard in Apple device management, Jamf makes it easy for you and your organization by offering a simplified cost structure, one contract for all your Apple device management needs, one upgrade schedule and one number to call for expert Apple advice.